Reconstruction in Database Forensics

Abstract : Despite the ubiquity of databases and their importance in digital forensic investigations, the area of database forensics has received very little research attention. This paper presents an algorithm for reconstructing a database for forensic purposes. Given the current instance of a database and the log of modifying queries executed on the database over time, the database reconstruction algorithm determines the data that was present in the database at an earlier time. The algorithm employs inverse relational algebra operators along with a relational algebra log and value blocks of relations to perform database reconstruction. Illustrative examples are provided to demonstrate the application of the algorithm and its utility in forensic investigations.
Document type :
Conference papers
Liste complète des métadonnées

https://hal.inria.fr/hal-01523705
Contributor : Hal Ifip <>
Submitted on : Tuesday, May 16, 2017 - 5:10:14 PM
Last modification on : Friday, December 1, 2017 - 1:16:43 AM
Document(s) archivé(s) le : Friday, August 18, 2017 - 12:36:14 AM

File

978-3-642-33962-2_19_Chapter.p...
Files produced by the author(s)

Licence


Distributed under a Creative Commons Attribution 4.0 International License

Identifiers

Citation

Oluwasola Fasan, Martin Olivier. Reconstruction in Database Forensics. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. pp.273-287, ⟨10.1007/978-3-642-33962-2_19⟩. ⟨hal-01523705⟩

Share

Metrics

Record views

81

Files downloads

34